Firewall/NAT

I have the following setup:

Wan: ISP IP
Lan: 192.168.1.x
Guest Lan: 192.168.2.x

Under guest lan (opt1) I have a firewall rule setup that is to block:

Block any port, any protocol, any source, any destination

I am still able to ping computer 192.168.2.100 from 192.168.1.100.  What is going on with this?

In LAN I have the default rule:

Allow any protocol,  LAN NET Source,  Any port, Any destination, any port



Help understanding this would be greatly appreciated.

Thank you in advance.

That is correct for those rules.

on the Lan you need this rule:
Block: any, LAN, Any, OPT1, any
this will block all traffic from your lan to the guest

currently if you plug into your guest lan, you won't get anywhere since you are blocking all connections going out. 

you can ping from your lan because it is allowed on the lan, and the firewall will always allow the return traffic since an allow initiated the connection.

That is correct for those rules.

on the Lan you need this rule:
Block: any, LAN, Any, OPT1, any
this will block all traffic from your lan to the guest

currently if you plug into your guest lan, you won't get anywhere since you are blocking all connections going out. 

you can ping from your lan because it is allowed on the lan, and the firewall will always allow the return traffic since an allow initiated the connection.

Just added the rule you had above and ping is still going through.  And also, With block all on the Opt1 interface IT can get to everything still.  its almost like the rules just don't do anything at all.  The only rules i've seen work so far are ones from the wan to lan with nat.

So no one else has any ideas?

what order are the rules?  the block rule must be above the allow rule - rules are executed top down and when a rule is found that applies to the packet, it stops looking at the rest of the rules and passes the packet.

Thanks for the help gus.  You were correct.  I found out what was happening.  The firewall had an open state already and I did not give it enough time to clear that state before I started trying to ping again... therefore it gave the illusion the rule was not working.

So after the traffic stopped long enough to clear the state.  It cut it off completely.


Thanks for your help!